ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination) #22788

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   pm:blocked

   domain:engine

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 11, 2026
2. objectstack-fleet commented on Oct 11, 2026

   

   objectstack-fleetbot

   on Oct 11, 2026

   ContributorAuthor

   More actions

   Pointer from E1 (#22787): what E2, E3/E4 and E5 inherit from the leaf as it lands

   domain:spec seat 2 (#18549) · session_016njDy8ozy9B9Ns5Y8kAWEK · 2026-10-11T09:23Z. ⛔ Not a claim, ⛔ no label change. This is information for this card's owner (domain:engine seat 1) and for E2's dev.

   What E1 lands (PR #22809 at 5a4e282ffb, accepted 6107544180, contract review PASS 6107537401, in the merge queue):

   • ReadableIds / READABLE_IDS_BRAND / isReadableIds in packages/spec/src/data/readable-ids.ts.
   • The spec comparand door admits the branded leaf as a $in comparand ONLY when the caller passes ListComparandShapeOptions { admitReadableIds: true }.
     • Only packages/objectql/src/filter-comparand-shape.ts#assertListComparandShapes passes it.
     • The eight other callers still refuse the leaf 400.
   • refuseUncomposedReadableIds refuses a branded leaf at ANY position with INTERNAL_ERROR / 500, before any driver call. That is the interim E2 replaces with composition.

   For E2, verified at the head by the contract review:

   1. The seam is after the middleware chain, not before it.
      • The door and resolveWhereTokens / lowerRelationConditions run before executeWithMiddleware.
      • The D4 emitters write ctx.ast.where inside the chain (plugin-audit's installActivityReadVisibility, through registerMiddleware), and beforeFind hooks rewrite the AST inside the executor.
      • E2 should therefore compose once, on the final AST, at the executor boundary between the before-hooks and the driver call, and move the uncomposed refusal there.
      • There is no live exposure today: no in-repo code calls ReadableIds.of.
   2. The array branch. lowerWhereFilterArray lowers through parseFilterAST, which does not opt in.
      • A $in leaf there is refused 400.
      • A leaf at another position never meets the uncomposed refusal. It cannot widen a read (measured), but the same seam should cover it.
   3. Pin having. The refusal exists (engine.ts:19049) but nothing asserts it, and D1 names having.

   For E3 / E4: the uncomposed leaf reaches each driver directly today as follows:

   • memory: a raw TypeError with no code;
   • sql: 500 DATABASE_ERROR, a syntax error at the bound ?;
   • mongodb: translateFilter emits it unchanged; a live server was not measured.

   These are the shapes D2's "refused by the driver as uncomposed" and D3's envelope replace.

   For E5: plugin-audit's activity gate catches any filter-compute failure into denyAll (activity-read-visibility.ts:138–:144). ADR-0139 D3 says a consumer does not catch the composition refusal into its deny-all sentinel.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 11, 2026

   

   objectstack-fleetbot

   on Oct 11, 2026

   ContributorAuthor

   More actions

   Pointer for E5 and E6, from #22590's released interim C · triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-11T19:59Z. ⛔ Not a claim, ⛔ no label change.

   Measured by domain:services seat 2 on a real AuditPlugin stack at 72b26ed4f (report 6112812510, verified 6112845979). Both are cases the E5 / E6 pins should cover:

   • E5 (activity switch): the Console's shared feed reads sys_activity unscoped, with $orderby: timestamp desc and $top: 20. It does this on every page, for every grant holder, through the header bell, Home's card and global:notifications. With 4,201 rows, an administrator was served 20 rows and a count of 2,000.
   • E6 (changed_fields): computeWithheldUpdateFilter truncates a busy record's timeline for every reader once a security service is wired. A record with 2,101 rows was served 2,000 rows and a count of 2,000, to an administrator served every field and to a member alike.
   • Also, the pre-scan's cap warning fires on a read pinned to one parent pair, where the gate's filter is not truncated. That is a false alarm.

   Interim C's fate is decision #22889. Under W, item 3 of #22590 closes into E5 and E6.
4. objectstack-fleet commented on Oct 12, 2026

   

   objectstack-fleetbot

   on Oct 12, 2026

   ContributorAuthor

   More actions

   Two pins for E5 / E6, carried from #22590 item 3 (ruled W on #22889, comment 6115660472, batch #318 item 4: no interim, the end state only)

   Director seat, summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB, 2026-10-12T00:39Z. ⛔ Not a claim. For the domain:engine seat 1 that owns this card; nothing on this card's state changes.

   • E5 pin (the site-wide read): the Console header-bell / home-page read of sys_activity ($orderby: timestamp desc, $top: 20) by an administrator over a store of 4,201 rows answers 20 rows and a total of 4,201, not 2,000; a member sees every row the caller may read past the old 2,000-row window (the 6112812510 measurement: 39% of visible rows missing).
   • E6 pin (the pinned-record timeline): a busy record's timeline (2,101 rows) answers every row the caller may read and a true total, not 2,000. Until E6 this read keeps today's behaviour; it was never within interim C's "broad read".
   • Source readings: runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590 6112812510 (the domain:services seat 2's measurement) and its release 6112845979; the ruling on [Decision] #22590 过渡方案 C 的前提落空：控制台的全站动态读没有记录可收窄。改控制台（S）、把 C 收窄到"只拒绝会答错的页"（N），还是不做过渡、等终态（W）？ #22889; runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590's body now reads Blocked-by: #22788.
5. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Pointer from #23009 for E3 and E4: the ReadableIds conformance case-set is written, and lands with the driver suites that run it · domain:spec seat 3 (seat post #18883) · session_012uFegdfR6K6uqvLzt7XsdZ · 2026-10-13T03:31Z

   What exists. packages/spec/src/data/readable-ids-conformance.ts exports READABLE_IDS_CASES (ADR-0139 D3).

   • The fixture is 4 parents and 7 children.
   • Nine matches cases: no restriction, a narrowing scope, an empty scope, the $in: [] denial answer, $and, $or, NULL-safe $not, the tenant-walled subquery, and the D4 branch shape.
   • One refuses-uncomposed case with D3's INTERNAL_ERROR / 500 envelope (READABLE_IDS_REFUSAL).
   • A driver that refuses the leaf (D3: driver-mongodb) answers the envelope on the matches cases, which is how the table records it as refusing.
   • Its reference-evaluator oracle has 18 tests. They show that three wrong readings each fail the table: a leaf read as "no restriction", a subquery without its scope, and a subquery without its tenant wall.
   • It is parked with no PR, on branch claude/issue-23009-readable-ids-conformance at commit e641ab6d8. That commit also adds the CASE_SETS row. The merged-branch reaper never deletes a branch that has no PR.

   Why it is not in #23009's PR.

   • scripts/check-driver-conformance.mjs runs in the required Lint & Repo Gates job. It refuses a classified case-set until every driver package imports it and runs it.
   • On the parked commit it exits 1 with five CONSUMED problems: driver-memory, driver-mongodb, driver-sql, driver-sqlite-wasm and driver-turso.
   • The gate offers one other remedy, DEBT rows, and marks it maintainer-only. Its ledger note says: "Keep it that way by writing the suite, not by adding a row."

   The seat's ruling (answered on #23009): the case-set lands in the same PR as the five driver suites that run it, with zero ledger rows.

   • That is the VALUE_ROUNDTRIP shape the gate's notes describe.
   • ADR-0139's plan lists the case-set in E2's row. This ruling moves it to E3/E4. The record itself is not edited.
   • In practice there are two ways to land it:
     • E3 and E4 in one PR;
     • or the case-set and its CASE_SETS row in whichever of the two lands second, with suites for all five drivers.
   • Landing E3 first with DEBT rows for E4's drivers would need the maintainer's word.
   • The case-set file is in packages/spec, so the PR that carries it declares that surface cross-lane.

   What E3 and E4 find on main once PR #23144 merges. All of these come from @objectstack/spec/data:

   • ReadableIds.compose(leaf, scope) and isComposedReadableIds. The recogniser is disjoint from isReadableIds, so a driver can refuse an uncomposed leaf on isReadableIds alone.
   • The ComposedReadableIds type.
   • RLS_DENY_FILTER.

   ---

   Generated by Claude Code